Severity
High
Analysis Summary
Meta has disclosed a critical security vulnerability affecting its shared customer support infrastructure, where inconsistent authorization checks exposed sensitive user information across multiple support services. Initially identified during security testing of Meta Horizon Managed Solutions, the issue was later found to extend beyond a single product, impacting Meta.com support systems, customer support chat platforms, and internal case management workflows. The flaw originated from weaknesses in Meta’s backend authorization logic, allowing certain GraphQL operations to return sensitive support data even when users lacked the required permissions.
The vulnerability enabled unauthorized access to a wide range of confidential customer support information, including email conversations with Meta, live chat transcripts, internal support notes, escalation details, case metadata, and files uploaded during support interactions. Many of these records contained personally identifiable information (PII), such as names, email addresses, phone numbers, and other contact details provided by users while seeking assistance. Researchers also discovered that support case identifiers were assigned sequentially, allowing attackers to enumerate case IDs and potentially retrieve large volumes of sensitive records, significantly amplifying the overall impact of the flaw.
Beyond unauthorized data exposure, the vulnerability also permitted attackers to perform privileged actions without proper authorization. These included creating support requests on behalf of other organizations, modifying the status of existing support cases, and adding external users as subscribers to ongoing support tickets. Such capabilities could have enabled malicious actors to manipulate customer support workflows, monitor confidential communications, or interfere with incident handling processes. Although parts of the affected infrastructure relied on Salesforce-backed systems, the root cause was not a Salesforce vulnerability but rather flaws in Meta’s implementation of authorization controls across shared backend services.
The issue, discovered by security researcher, was reported to Meta in January 2026 and later upgraded to critical after the broader cross-platform impact was confirmed. Meta fully remediated the vulnerability by April 2026, with no evidence of active exploitation reported. The flaw aligns with several well-known security weaknesses, including Broken Access Control (CWE-284), Insecure Direct Object Reference (CWE-639), and Missing Authorization (CWE-862). This incident highlights the security risks of shared backend architectures and emphasizes the importance of enforcing consistent authorization checks, validating user permissions at every application layer, and implementing secure access controls to protect sensitive customer communications across interconnected services.
Impact
- Sensitive Information Theft
- Gain Access
Remediation
- Apply Meta's security updates and ensure all affected support platforms are running the latest patched versions.
- Enforce server-side authorization checks for every request to verify that users can only access resources they are explicitly authorized to view or modify.
- Implement the principle of least privilege by granting users and support staff only the minimum permissions required for their roles.
- Replace predictable sequential identifiers with random, non-enumerable IDs (such as UUIDs) to prevent support case enumeration.
- Secure GraphQL APIs by validating authorization for every query and mutation, regardless of the client or endpoint.
- Restrict access to sensitive support data, including emails, chat transcripts, attachments, and internal notes, based on role-based access control (RBAC).
- Conduct regular access control and authorization testing, including penetration testing and code reviews, to identify Broken Access Control and IDOR vulnerabilities.
- Monitor and log access to customer support systems and configure alerts for unusual activities, such as bulk case enumeration or unauthorized access attempts.